CVE-2026-55897

Executive Summary

CVE-2026-55897 is an OS command injection vulnerability (CWE-78) in luci-app-advanced-reboot, a LuCI web interface application for OpenWrt that provides a way to reboot a router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to version 1.1.2-6, an overly permissive read ACL grants rpcd file.exec permission for the general shell interpreter /bin/sh, allowing an authenticated delegated session to supply caller-controlled parameters that rpcd passes to the shell, resulting in arbitrary command execution as root. The vulnerability carries a CVSS 3.1 base score of 8.8 (High) and affects OpenWrt builds containing the vulnerable ACL grant, while branches such as openwrt-24.10 and openwrt-23.05 that lack the /bin/sh exec grant are not affected by this specific chain.

Technical Analysis

The vulnerability resides in the read access control list shipped with the luci-app-advanced-reboot package, located at applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json. In rpcd, the OpenWrt ubus RPC daemon, ACL definitions map authenticated scopes to permitted ubus methods and file operations. The vulnerable ACL grants the read scope the file.exec permission targeting the general-purpose shell interpreter /bin/sh.

The core weakness is a trust-boundary failure combined with unsanitized argument passing. rpcd authorizes an RPC call by validating the executable path against the ACL — in this case /bin/sh is a legitimately permitted path. However, rpcd then passes caller-controlled parameters as arguments to that permitted executable. Because /bin/sh interprets its arguments as a command string (e.g., via -c), any caller able to invoke file.exec under the read ACL can inject arbitrary shell commands that execute with the privileges of the rpcd process, which runs as root on OpenWrt. This is a classic CWE-78 OS command injection facilitated by an ACL that permits an interpreter rather than a narrowly scoped, non-interpreter binary.

The permission model intended that "read" ACL holders could only perform limited reboot/partition-selection operations exposed by the application. The grant of file.exec against /bin/sh effectively elevates a low-privilege delegated session to full root command execution. The attack surface is the RPC endpoint over which the delegated session communicates; no user interaction is required beyond an already-authenticated session with the vulnerable read ACL. Because the exploitation depends solely on the presence of the /bin/sh exec grant in the ACL file, builds without that grant — including the checked openwrt-24.10 and openwrt-23.05 branches — are not affected by this specific chain. The flaw is fixed in 1.1.2-6, where the ACL no longer confers this dangerous exec capability.

Notably, the NVD description does not specify the exact JSON keys beyond the file.exec permission and the /bin/sh target, nor the precise RPC method names or parameter names used. Those implementation specifics are not enumerated here to avoid fabrication; the mechanism is inferable at the vulnerability-class level from the description.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (OS command injection via a permitted interpreter in an rpcd ACL) and the NVD description.

1. Reconnaissance / target identification: An attacker identifies an OpenWrt device running LuCI with the luci-app-advanced-reboot package at a version prior to 1.1.2-6. The attacker determines that a delegated session with the read ACL for the application exists or can be obtained (for example, a low-privilege delegated account provisioned for limited reboot operations). Network exposure of the LuCI/rpcd management interface (AV:N) is required for remote exploitation.

2. Triggering the flaw class: Using the authenticated delegated session, the attacker invokes the rpcd file.exec facility under the granted read ACL, specifying the authorized executable path /bin/sh and supplying caller-controlled parameters. rpcd authorizes the executable path because /bin/sh is present in the grant, then passes the attacker-supplied arguments to the shell.

3. Payload/execution: Because /bin/sh is a general interpreter, the caller-controlled arguments are interpreted as shell input, achieving arbitrary command execution. At the vulnerability-class level, this is command injection through an over-permissive exec ACL rather than a bespoke memory-corruption or logic flaw. No specific payload strings or function names beyond /bin/sh are documented in the source data.

4. Post-exploitation impact: Commands execute as root (the rpcd privileges on OpenWrt), yielding complete compromise of the device: reading/modifying configuration, altering firmware or boot behavior, installing persistence, pivoting into the routed network, or intercepting traffic. The high confidentiality, integrity, and availability impact aligns with the CVSS subscores (C:H/I:H/A:H).

Conditions: Exploitation requires (a) an authenticated delegated session holding the vulnerable read ACL and (b) a build containing the /bin/sh exec grant. Builds lacking the grant (e.g., the checked openwrt-24.10 and openwrt-23.05 branches) are not affected by this specific chain.

Impact Assessment

Business impact is significant for organizations deploying OpenWrt-based routers, gateways, or embedded appliances with the affected luci-app-advanced-reboot package and ACL. Successful exploitation grants root-level arbitrary command execution, enabling full device takeover. The blast radius extends to any network segment the device routes or bridges, since a compromised edge device can serve as a pivot point for lateral movement, DNS manipulation, traffic interception, or persistent access.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 8.8) reflects: network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts. The PR:L rating corresponds to the requirement for an authenticated delegated session, which tempers the severity relative to an unauthenticated flaw but remains high given the complete root compromise achieved. No EPSS score is yet assigned by FIRST.org, and CVE-2026-55897 is not listed in CISA KEV, indicating no confirmed exploitation in the wild at the time of writing. Affected version data and OSV package mappings were not available from tracked sources.

Detection Guidance

Sigma Rule

title: OpenWrt luci-app-advanced-reboot rpcd /bin/sh Exec ACL Command Injection
id: 3f9c2a71-5589-7c01-9a2b-0e4d5f6a7b8c
status: experimental
description: Detects rpcd file.exec invocation targeting /bin/sh via the luci-app-advanced-reboot read ACL, indicating possible CVE-2026-55897 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55897
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: rpcd
detection:
  selection_exec:
    CommandLine|contains:
      - '/bin/sh'
  selection_rpcd:
    ProcessName|endswith:
      - 'rpcd'
  condition: selection_exec and selection_rpcd
fields:
  - CommandLine
  - User
  - ProcessName
falsepositives:
  - Legitimate administrative scripts invoking /bin/sh through rpcd
level: high

YARA Rule

rule CVE_2026_55897_luci_advanced_reboot_acl
{
    meta:
        description = "Detects vulnerable luci-app-advanced-reboot ACL granting file.exec on /bin/sh"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55897"
        date = "2026-01-01"
        severity = "high"

    strings:
        $acl_path = "luci-app-advanced-reboot.json"
        $exec = "file.exec"
        $shell = "/bin/sh"
        $app = "luci-app-advanced-reboot"

    condition:
        (uint32(0) == 0x464C457F or $app or $acl_path) and
        $acl_path and $exec and $shell
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55897 OpenWrt luci-app-advanced-reboot rpcd file.exec /bin/sh command injection attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"ubus"; http.request_body; content:"file.exec"; http.request_body; content:"/bin/sh"; classtype:attempted-admin; reference:cve,2026-55897; sid:202655897; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name == "rpcd"]
  [process where process.parent.name == "rpcd" and process.executable == "/bin/sh"]

Splunk SPL Query

index=openwrt OR index=linux sourcetype=syslog
| search "rpcd" AND ("file.exec" OR "/bin/sh")
| stats count values(_raw) as events by host src_ip user
| where count > 0

Wazuh OSSEC Rule

<group name="openwrt,cve-2026-55897,">
  <rule id="100897" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">rpcd</field>
    <regex field="command">/bin/sh</regex>
    <description>CVE-2026-55897: Possible rpcd file.exec /bin/sh command injection on OpenWrt luci-app-advanced-reboot</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Remove or restrict the vulnerable read ACL grant for file.exec on /bin/sh in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json so that the read scope no longer authorizes an interpreter.
• Limit who can obtain a delegated session holding the affected read ACL, and audit delegated accounts.
• Restrict network access to the LuCI/rpcd management interface (avoid exposing it to untrusted networks; segment management access).

2. Patch/upgrade steps:

• Upgrade luci-app-advanced-reboot to version 1.1.2-6 or later, where the dangerous /bin/sh exec grant is removed.
• Verify the deployed ACL file no longer grants file.exec on /bin/sh after upgrade.
• Confirm whether the running build even contains the /bin/sh exec grant; builds without it (including the checked openwrt-24.10 and openwrt-23.05 branches) are not affected by this specific chain.

3. Long-term hardening:

• Adopt least-privilege ACL design: never grant file.exec against general interpreters such as /bin/sh; scope exec permissions to narrowly purposed binaries.
• Implement configuration baselines and integrity monitoring for rpcd ACL files to detect reintroduction of risky grants.
• Maintain inventory and version tracking of LuCI applications and OpenWrt branches to rapidly identify vulnerable packages.

References

• NVD — CVE-2026-55897: https://nvd.nist.gov/vuln/detail/CVE-2026-55897
• CWE-78 Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• OpenWrt project documentation on rpcd and ACL configuration: https://openwrt.org/docs/guide-developer/ubus
• LuCI application repository (luci-app-advanced-reboot): https://github.com/openwrt/luci
• FIRST.org EPSS (no score currently assigned): https://www.first.org/epss
• CISA Known Exploited Vulnerabilities catalog (CVE not listed; no confirmed in-the-wild exploitation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog